Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a70bbfa authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik Committed by Pablo Neira Ayuso
Browse files

netfilter: Validate the sequence number of dataless ACK packets as well 

We spare nothing by not validating the sequence number of dataless
ACK packets and enabling it makes harder off-path attacks.

See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel,
http://arxiv.org/abs/1201.2074



Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 64f509ce

net/netfilter/nf_conntrack_proto_tcp.c

+2 −8
Original line number Diff line number Diff line
@@ -630,15 +630,9 @@ static bool tcp_in_window(const struct nf_conn *ct, 
		ack = sack = receiver->td_end;

	}



	if (seq == end

	    && (!tcph->rst

		|| (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))

	if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)

		/*

		 * Packets contains no data: we assume it is valid

		 * and check the ack value only.

		 * However RST segments are always validated by their

		 * SEQ number, except when seq == 0 (reset sent answering

		 * SYN.

		 * RST sent answering SYN.

		 */

		seq = end = sender->td_end;